The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/calculate-version.js is vulnerable to command injection. It uses the child_process.execSync function to run a git log command where the arguments are derived directly from the output of git describe without any validation or escaping. A malicious actor with the ability to influence git tags (e.g., in a shared repository or local environment) could execute arbitrary shell commands on the host system.
Evidence: In scripts/calculate-version.js, the variable lastTag is populated from execSync('git describe --tags --abbrev=0 2>/dev/null') and then interpolated into logCmd = \git log ${lastTag}..HEAD --format=%B`, which is subsequently executed via execSync(logCmd)`.
[DYNAMIC_EXECUTION]: The skill performs dynamic shell command execution via Node.js in scripts/calculate-version.js. The use of execSync on strings constructed at runtime from environment data (git tags and logs) is a high-risk pattern for local exploitation.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of git commit messages and tag names within scripts/calculate-version.js and through environment configuration files.
Ingestion points: Git history and tag metadata are read into scripts/calculate-version.js via execSync calls; project .env files are used to drive environment configuration.
Boundary markers: None are present to distinguish between legitimate system metadata and malicious payloads embedded in git history or configuration.
Capability inventory: The skill has the capability to execute shell commands (execSync in Node, warden env exec in CLI), perform database imports/exports, and access project configuration files.
Sanitization: No sanitization or input validation is performed on the data retrieved from the git environment before it is used in further command execution.

warden-dev